Add new resource for Kubernetes API proxy (#279)

This adds a new resource which deploys a Kubernetes API server proxy
that can be used to access the API server without tokens through
Netbird.

Part of #274 

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added ClusterProxy custom resource for cluster API proxying
capabilities

* **Documentation**
  * Added ClusterProxy API reference documentation with schema details

* **Examples**
* Added example ClusterProxy configuration and RBAC setup for cluster
proxy targets

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/netbirdio/kubernetes-operator/pull/279?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This commit is contained in:
Philip Laine
2026-06-01 11:41:48 +02:00
committed by GitHub
parent a3546e4804
commit 5dd73dcc80
19 changed files with 1177 additions and 31 deletions
+70
View File
@@ -0,0 +1,70 @@
apiVersion: netbird.io/v1alpha1
kind: ClusterProxy
metadata:
name: prod
namespace: netbird
spec:
clusterName: prod
serviceAccountName: clusterproxy-prod
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: clusterproxy-prod
namespace: netbird
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: clusterproxy-prod
rules:
- apiGroups:
- ""
resources:
- users
- groups
verbs:
- impersonate
- apiGroups:
- authentication.k8s.io
resources:
- userextras/*
- uids
verbs:
- impersonate
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: clusterproxy-prod
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: clusterproxy-prod
subjects:
- kind: ServiceAccount
name: clusterproxy-prod
namespace: netbird
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: netbird-cluster-reader
rules:
- apiGroups: ["*"]
resources: ["*"]
verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: netbird-cluster-reader
subjects:
- kind: Group
name: kubernetes-read
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: netbird-cluster-reader
apiGroup: rbac.authorization.k8s.io